# Prometheus systemd服务单元文件
# 此文件定义Prometheus服务的启动配置、依赖关系和安全设置
# 参考：https://prometheus.io/docs/prometheus/latest/installation/

[Unit]
Description=Prometheus Server
Documentation=https://prometheus.io/docs/
After=network-online.target
Wants=network-online.target

[Service]
# 服务类型
Type=simple

# 运行用户和组
User={{ prometheus_user }}
Group={{ prometheus_group }}

# 执行命令
ExecStart={{ prometheus_binary_path }}/prometheus \
  --config.file={{ prometheus_config_dir }}/prometheus.yml \
  --storage.tsdb.path={{ prometheus_data_dir }} \
  --storage.tsdb.retention.time={{ prometheus_retention_time }} \
{% if prometheus_retention_size is defined and prometheus_retention_size != "" %}
  --storage.tsdb.retention.size={{ prometheus_retention_size }} \
{% endif %}
  --web.console.libraries={{ prometheus_binary_path }}/console_libraries \
  --web.console.templates={{ prometheus_binary_path }}/consoles \
  --web.listen-address={{ prometheus_web_listen_address }} \
  --web.external-url={{ prometheus_web_external_url }} \
{% if prometheus_web_route_prefix is defined %}
  --web.route-prefix={{ prometheus_web_route_prefix }} \
{% endif %}
{% if prometheus_web_enable_lifecycle %}
  --web.enable-lifecycle \
{% endif %}
{% if prometheus_web_enable_admin_api %}
  --web.enable-admin-api \
{% endif %}
{% if prometheus_web_config_file is defined and prometheus_web_config_file != "" %}
  --web.config.file={{ prometheus_web_config_file }} \
{% endif %}
{% if prometheus_log_level is defined %}
  --log.level={{ prometheus_log_level }} \
{% endif %}
{% if prometheus_log_format is defined %}
  --log.format={{ prometheus_log_format }} \
{% endif %}
{% if prometheus_query_max_concurrency is defined %}
  --query.max-concurrency={{ prometheus_query_max_concurrency }} \
{% endif %}
{% if prometheus_query_timeout is defined %}
  --query.timeout={{ prometheus_query_timeout }} \
{% endif %}
{% if prometheus_query_max_samples is defined %}
  --query.max-samples={{ prometheus_query_max_samples }} \
{% endif %}
{% if prometheus_alertmanager_notification_queue_capacity is defined %}
  --alertmanager.notification-queue-capacity={{ prometheus_alertmanager_notification_queue_capacity }} \
{% endif %}
{% if prometheus_alertmanager_timeout is defined %}
  --alertmanager.timeout={{ prometheus_alertmanager_timeout }} \
{% endif %}
{% for arg in prometheus_extra_args %}
  {{ arg }} \
{% endfor %}
  $PROMETHEUS_OPTS

# 重启策略
Restart=always
RestartSec=5

# 环境变量文件
{% if prometheus_environment_file is defined %}
EnvironmentFile={{ prometheus_environment_file }}
{% endif %}

# 工作目录
WorkingDirectory={{ prometheus_data_dir }}

# 标准输出和错误输出
StandardOutput=journal
StandardError=journal
SyslogIdentifier=prometheus

# 进程限制
LimitNOFILE={{ prometheus_limit_nofile }}
LimitNPROC={{ prometheus_limit_nproc }}

# 安全设置
# 禁止新特权
NoNewPrivileges=true

# 只读根文件系统
{% if prometheus_security_readonly_root_filesystem %}
ReadOnlyPaths=/
{% endif %}

# 可写路径
ReadWritePaths={{ prometheus_data_dir }}
{% if prometheus_config_dir != '/etc/prometheus' %}
ReadWritePaths={{ prometheus_config_dir }}
{% endif %}
{% for path in prometheus_security_readwrite_paths %}
ReadWritePaths={{ path }}
{% endfor %}

# 私有临时目录
{% if prometheus_security_private_tmp %}
PrivateTmp=true
{% endif %}

# 私有设备
{% if prometheus_security_private_devices %}
PrivateDevices=true
{% endif %}

# 保护主机名
{% if prometheus_security_protect_hostname %}
ProtectHostname=true
{% endif %}

# 保护时钟
{% if prometheus_security_protect_clock %}
ProtectClock=true
{% endif %}

# 保护内核调优
{% if prometheus_security_protect_kernel_tunables %}
ProtectKernelTunables=true
{% endif %}

# 保护内核模块
{% if prometheus_security_protect_kernel_modules %}
ProtectKernelModules=true
{% endif %}

# 保护控制组
{% if prometheus_security_protect_control_groups %}
ProtectControlGroups=true
{% endif %}

# 限制地址族
{% if prometheus_security_restrict_address_families %}
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
{% endif %}

# 限制名称空间
{% if prometheus_security_restrict_namespaces %}
RestrictNamespaces=true
{% endif %}

# 锁定个性
{% if prometheus_security_lock_personality %}
LockPersonality=true
{% endif %}

# 内存拒绝写入执行
{% if prometheus_security_memory_deny_write_execute %}
MemoryDenyWriteExecute=true
{% endif %}

# 限制实时
{% if prometheus_security_restrict_realtime %}
RestrictRealtime=true
{% endif %}

# 限制SUID/SGID
{% if prometheus_security_restrict_suid_sgid %}
RestrictSUIDSGID=true
{% endif %}

# 移除IPC
{% if prometheus_security_remove_ipc %}
RemoveIPC=true
{% endif %}

# 系统调用过滤器
{% if prometheus_security_system_call_filter %}
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
{% endif %}

[Install]
WantedBy=multi-user.target